High advisory for Docker Sandboxes sbx cp does not safely

Advisory overview

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.

Related references

• https://docs.docker.com/ai/sandboxes/
• https://docs.docker.com/ai/sandboxes/security/isolation/
• https://github.com/docker/sbx-releases/releases/tag/v0.51.0